CVE-2026-55217CWE-285

CVE-2026-55217

published September 25, 2026

CVSS
5.3
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26.

The record
Technical detail
CVSS
5.3 · NONE
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-285 · Improper Authorization
Published
2026-09-25T23:17Z
References (5)
https://github.com/glpi-project/glpi/commit/1cbf69b99dfd0610f1c03a3f245f3b248e1bfde0 · [email protected]https://github.com/glpi-project/glpi/commit/9c29f25bd09eca9e62ca50c52b3ebd15b02997b2 · [email protected]https://github.com/glpi-project/glpi/releases/tag/10.0.26 · [email protected]https://github.com/glpi-project/glpi/releases/tag/11.0.8 · [email protected]https://github.com/glpi-project/glpi/security/advisories/GHSA-xm3v-3g6q-g9q8 · [email protected]
EPSS history
Timeline
  • 27 SEP 03:26Z
    EPSS moved — → 0%
    epss
  • 25 SEP 18:29Z
    GLPI: Unallowed modfication of knowbase items comments and translations
    cvelistv5